feat(release): publish nightly and stable releases through npm trusted publishing

.github/actions/setup-node-pnpm/action.yml

@@ -10,6 +10,10 @@ inputs:
     description: 'Whether to install dependencies with pnpm install --frozen-lockfile'
     required: false
     default: 'true'
+  cache-store:
+    description: 'Whether installing dependencies may restore and save the pnpm store cache'
+    required: false
+    default: 'true'
   cache-dependency-path:
     description: 'Lockfile path(s) used to key the pnpm store cache'
     required: false
@@ -48,7 +52,7 @@ runs:
         # Only cache the pnpm store when this action also installs dependencies.
         # Jobs with install-deps: false never create the store, and on a cache
         # miss (any lockfile-changing PR) the post-job cache save fails the job.
-        cache: ${{ inputs.install-deps == 'true' && 'pnpm' || '' }}
+        cache: ${{ inputs.install-deps == 'true' && inputs.cache-store == 'true' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
     # Corepack resolves the same `packageManager` field locally, so a mismatch

.github/workflows/publish-mcp-registry.yml

@@ -1,9 +1,13 @@
 name: Publish MCP Registry
 
 on:
-  release:
-    types:
-      - published
+  # release.yml calls this after publishing a stable release; dispatch reruns it for one tag.
+  workflow_call:
+    inputs:
+      release_tag:
+        description: GitHub Release tag to publish metadata for, for example v0.16.5.
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
       release_tag:
@@ -32,30 +36,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.event.inputs.checkout_ref || github.ref }}
+          ref: ${{ inputs.checkout_ref || github.ref }}
 
       - name: Setup Node.js
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '24.13'
 
-      - name: Resolve release metadata
-        id: meta
+      # A released commit carries main's -dev version; stamp the tag's version into
+      # package.json and server.json before publishing the metadata.
+      - name: Stamp release version
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
-          set -euo pipefail
-          PACKAGE_VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
-          SERVER_VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('server.json', 'utf8')).version")"
-          TAG_NAME="${{ github.event.release.tag_name || github.event.inputs.release_tag }}"
-          VERSION="${TAG_NAME#v}"
-          if [ "$VERSION" != "$PACKAGE_VERSION" ]; then
-            echo "Release tag $TAG_NAME does not match package.json version $PACKAGE_VERSION" >&2
-            exit 1
-          fi
-          if [ "$VERSION" != "$SERVER_VERSION" ]; then
-            echo "Release tag $TAG_NAME does not match server.json version $SERVER_VERSION" >&2
-            exit 1
-          fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          npm pkg set "version=${RELEASE_TAG#v}"
+          node scripts/sync-mcp-metadata.mjs
         shell: bash
 
       # This job provisions pnpm via plain actions/setup-node, not the repo's

.github/workflows/release-android-snapshot-helper.yml

@@ -1,9 +1,13 @@
 name: Release Android Snapshot Helper
 
 on:
-  release:
-    types:
-      - published
+  # release.yml calls this after publishing a stable release; dispatch reruns it for one tag.
+  workflow_call:
+    inputs:
+      release_tag:
+        description: GitHub Release tag to upload assets to, for example v0.13.3.
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
       release_tag:
@@ -30,7 +34,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.event.inputs.checkout_ref || github.ref }}
+          ref: ${{ inputs.checkout_ref || github.ref }}
 
       - name: Setup Node.js
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
@@ -60,13 +64,8 @@ jobs:
         id: meta
         run: |
           set -euo pipefail
-          PACKAGE_VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
-          TAG_NAME="${{ github.event.release.tag_name || github.event.inputs.release_tag }}"
+          TAG_NAME="${{ inputs.release_tag }}"
           VERSION="${TAG_NAME#v}"
-          if [ "$VERSION" != "$PACKAGE_VERSION" ]; then
-            echo "Release tag $TAG_NAME does not match package.json version $PACKAGE_VERSION" >&2
-            exit 1
-          fi
           echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
         shell: bash

.github/workflows/release-ios-runner.yml

@@ -1,9 +1,13 @@
 name: Release iOS Runner
 
 on:
-  release:
-    types:
-      - published
+  # release.yml calls this after publishing a stable release; dispatch reruns it for one tag.
+  workflow_call:
+    inputs:
+      release_tag:
+        description: GitHub Release tag to upload assets to, for example v0.12.6.
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
       release_tag:
@@ -31,7 +35,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.event.inputs.checkout_ref || github.ref }}
+          ref: ${{ inputs.checkout_ref || github.ref }}
 
       - name: Setup toolchain
         uses: ./.github/actions/setup-node-pnpm
@@ -42,13 +46,8 @@ jobs:
         id: meta
         run: |
           set -euo pipefail
-          PACKAGE_VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
-          TAG_NAME="${{ github.event.release.tag_name || github.event.inputs.release_tag }}"
+          TAG_NAME="${{ inputs.release_tag }}"
           VERSION="${TAG_NAME#v}"
-          if [ "$VERSION" != "$PACKAGE_VERSION" ]; then
-            echo "Release tag $TAG_NAME does not match package.json version $PACKAGE_VERSION" >&2
-            exit 1
-          fi
           echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
         shell: bash